Getting Ready For The Retail Payment Activities Framework - New Policies Regarding Supervisory Enforcement

The Bank of Canada will launch the retail payment activities framework in just over four months and there have been new developments concerning its oversight approach. On June 17, 2024, the Bank published seven new supervisory policies outlining its enforcement tools and related processes, providing more insight into how it will oversee the Retail Payment Activities Act (RPAA).

New RPAA Enforcement Policies

1. Enforcement Tools Policy
   • The Bank has provided some additional details on its spectrum of enforcement tools, while noting that it will strive to maintain fairness through both a consistent and proportional approach to assessing RPAA violations by payment service providers (PSPs), with the aim of motivating PSPs to comply with their legislative obligations.
   • Possible enforcement tools that the Bank may use in the case of a violation range significantly - from a warning letter or voluntary compliance agreement, to a notice of violation (with or without a monetary penalty), a compliance order, a revocation of the PSP's RPAA registration, or ultimately a Court order requiring the individual or entity to comply or cease the contravention.
   • The Significant Adverse Impact Policy provides more details about the factors the Bank would likely consider in issuing a full or temporary compliance order.
   • Notices of Violation that are issued with a penalty could include an option to reduce the penalty by up to 50% if the PSP enters into a compliance agreement and remediates the violation within a specified timeframe.
2. Administrative Monetary Penalties Policy
   • If the Bank has reasonable grounds to believe that a PSP has committed a violation, the Bank may issue a Notice of Violation with a monetary penalty. The amounts can range from $0 up to $1 million for serious violations, or up to $10 million for very serious violations.
   • The Bank has provided further details on how it will determine a penalty amount and apply the RPAA regulations, including such factors as the amount prescribed by the RPAA regulations (if any), the harm done by the violation, the PSP's violation history, the degree of the PSP's negligence and intent, mitigating and aggravating factors, and whether the imposition of the penalty is a fair and proportionate tool that will encourage change in compliance behaviour. The stated objective of the administrative monetary penalty regime is to promote compliance with the RPAA framework, not to punish non-compliance, and so the policy notes the Bank will not apply the policy rigidly and allow for amounts to be determined on a case-by-case basis.
3. Enforcement Process Policies
   • The Enforcement Processes Policy outlines what PSPs can expect to happen if a potential violation is flagged by the Bank's internal supervisory department or raised by another regulatory body, stakeholder or the general public. The process will typically start by the Bank issuing a Notice of Investigation, followed by information collection. It will conclude with an exit interview and findings report, and, if considered necessary, the Bank utilizing one of the enforcement tools discussed above.
   • The Governor's Review Policy details the Bank's independent review process if an affected party does not agree with a supervisory decision. The four types of decisions that may be reviewed are: 1) a notice of refusal to register; 2) a notice of intent to revoke registration; 3) notice of violation (including any monetary penalty); and 4) a notice of default.
   • The Bank's Executive Director of Payments, Supervision and Oversight has been delegated the responsibility of independent reviewer by the Governor, as published in the Canada Gazette on June 15, 2024. The Roles and Responsibilities of the Executive Director and Managing Director Policy provides clarity on how the Bank separates the Governor's review function, led by the Executive Director, and its broader supervision functions, led by the Managing Director.
4. Publication Options
   • The Issuing Public Notice of Decisions Policy supports several of the enforcement policies. The Bank will publish details about PSPs regarding:
     • approved registrations (on its PSP registry, which will be available September 8, 2025);
     • brief descriptions of violations, compliance agreements with the Bank, and the amounts of any monetary penalties; and
     • extracts of decisions related to registration refusal/revocation and full decisions concerning violations, that are made by the Governor or his/her delegate, together with status update on any appeals to the Federal Court.

How We Can Help

The registration requirements of the RPAA will begin to take effect on November 1, 2024. Businesses that are currently operating as PSPs must submit a registration application between November 1-15, 2024.

Our Financial Services team can help navigate the various registration steps and ongoing compliance requirements under the RPAA, including:

• assessing whether you are required to register as a PSP;
• determining how, when and what information to register; and
• providing advice on key processes and best practices to comply with the RPAA and its guidelines.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.